AML And RegTech In The UAE

Failure to comply with the ever-growing AML requirements will subject Reporting Entities to hefty penalties and reputational damages. Mindful of the serious implications resulting from money laundering activities, Reporting Entities are relying on Regulatory Technology (RegTech) to ensure utmost compliance with AML regulations and mitigate their risks. RegTech is becoming indispensable particularly due to the lack of available human resources in the AML industry coupled with a growing demand in financial services. 

The United Arab Emirates (UAE) is showing rising interest in combatting money laundering activities through the use of RegTech as further described herein.

AML Legal Landscape In The UAE

UAE Mainland

The UAE has reaffirmed in recent years its commitment to combat money laundering and counter terrorist financing notably with (i) the introduction of AML legislation since 2018, (ii) the establishment of a National Committee to oversee the implementation of AML legislation and (iii) the creation of an anti-money laundering reporting platform under the name of “goAML”.

While the AML legal framework in the UAE is characterised by four pillars of legislation, the main piece of legislation is Federal Decree-Law No. 20/2018 On Combating Money Laundering Crimes, the Financing of Terrorism and the Financing of Unlawful Organisations (the AML Regulation). Furthermore, the UAE Central Bank regularly issues circulars to provide further guidance to the application of the AML Regulation.

For example, in line with international standards and following the recommendations of the Financial Action Task Force (FATF), the UAE has issued Circular No.3/2020. Pursuant to such circular, the UAE has started applying higher scrutiny on Designated Non-Financial Businesses and Professions (DNFBPs) which play an important role in controlling the flow of funds.

DNFBPs include activities involving brokers and real estate agents, dealers in precious metals and precious stones, trust and company service providers, auditors, accounting service providers and lawyers. DNFBPs are exposed to several risk areas relating to money laundering and terrorist financing and as such must follow elaborated customer due diligence processes and comply with hefty record keeping requirements.

Financial Free Zones

It is worth noting that Financial Free Zones such as the Dubai International Financial Centre (DIFC) and the Abu Dhabi Global Market (ADGM) are also subject to the federal AML Regulation in addition to developing their own AML framework which should be read in conjunction with the federal AML Regulation.

For instance, the DIFC has put in place the DFSA AML Rulebook and relies on its own regulatory body, The Financial Crime Prevention Team to oversee financial crime risks and ensure compliance with all AML legislations, rules and requirements that apply in the DIFC.

As for the ADGM, the federal AML Regulation is complemented by the Anti-Money Laundering and Sanctions Rules and Guidance (AML) and overseen by the ADGM’s financial regulator, the Financial Services Regulatory Authority (FSRA).

What Is RegTech?

In light of the above, Reporting Entities are on the lookout for time and cost-efficient processes to comply with their regulatory obligations and have found RegTech to come in handy. RegTech is the use of a software application by companies to manage regulatory compliance through various technologies such as automation, use of big data artificial intelligence and machine-learning technology.

One of the areas RegTech provides solutions for is AML compliance. As previously explained above, AML represents all efforts to detect and prevent financial crimes.

We have seen a worldwide rise in the use of RegTech, including in the UAE. This is because traditional compliance teams and manual processes are no longer sufficient for real time monitoring of financial activities, notably digital payments. This has pushed Reporting Entities to rethink their existing approach to AML compliance.

We note that, in addition to private companies, governmental entities responsible for overseeing AML operations have been heavily relying on RegTech as well. As such, RegTech presents two main angles: supporting regulators in overseeing AML compliance, as well as supporting Reporting Entities in monitoring their financial operations and completing their filings. 

Consequently, the recourse to RegTech has become more and more crucial and has gained popularity in recent years considering the benefits it offers. The main goal of RegTech, among others, is to solve the challenges arising from a technology-driven economy.

For example, some RegTech companies offer their users a Screening Software for their “Know Your Customer” (KYC) and “Customer Due Diligence” procedures required to onboard clients. These procedures are a common obligation under worldwide AML regulations to identify the customer’s risk level depending on various components.  For instance, it is crucial to determine if a client is subject to a sanctions list, PEP list or adverse media publications. Considering the extensive research required for this assessment and the massive volume of data available in this regard, manual controls have become almost impossible. Screening Softwares were created to address these difficulties and provide automated means to conduct the assessment.

Furthermore, an attractive feature of a RegTech software is the ability to create a centralised information storage. That way, Reporting Entities can manage their filings and ensure everything is accounted for in a centralised location which reduces the risk of incorrect data or lost data.

Another interesting aspect offered by advanced RegTech tools is providing alerts about relevant regulations. This is particularly important considering the constant changes in AML regulations and helps users stay up to date with any legislation developments.

In addition to the KYC and Customer Due Diligence requirements, financial institutions (including FinTech firms) have a higher AML burden as they are also required to monitor their customers’ transactions and flag any fraudulent or suspicious flow of money. For that purpose, RegTech offers Transaction Monitoring tools to assist companies in monitoring transactions that take place online in real-time to identify issues or irregularities in the digital payment sphere.

RegTech In The UAE

The increasing popularity of RegTech has been witnessed globally, including in the UAE. In fact, various initiatives have been taken by the private sector as well as the public sector to promote the use of RegTech for AML compliance purposes.

For instance, the ADGM has announced that it has started using a RegTech software to automate its licence applications. This software identifies and immediately clarifies information and risk gaps in licence applications.

The DIFC has also expressed its interest in RegTech by hosting various events and workshops around regulatory compliance using innovative technologies.

The electronic-Know-Your-Customer (e-KYC) utility project launched in 2018 is also a prominent initiative by the DIFC, the ADGM and multiple leading financial institutions in the UAE. This initiative aims to develop a blockchain-based e-KYC solution that would provide financial institutions with a single location where customer identification and verification can be performed once for a customer.

Given the public sector’s enthusiasm towards RegTech, Global RegTech players have now expanded into the UAE market. In addition, there are several home-grown RegTech players which were recently introduced to the market.

In the presence of multiple RegTech players in the market, how can Reporting Entities select the right RegTech software? Upon selecting their RegTech providers, Reporting Entities are advised to evaluate the following criteria:

• Ongoing Support: When reviewing agreements with RegTech service providers, Reporting Entities must be cautious about the service level agreement offered and the RegTech’s response time in case of performance issues. This is particularly important as AML monitoring is a 24/7 requirement and any downtime of the software may open doors to fraudulent transactions. Companies must therefore carefully evaluate their agreements with RegTech companies to ensure that a satisfactory service level agreement is provided for.

• Testing & Flexibility: Given the infancy of RegTech, Reporting Entities must be able to test the RegTech software before committing to a long-term agreement with the service provider. Testing is crucial to ensure that the selected software is in line with the business needs. Furthermore, there are no one-size fits all models that can accommodate the needs of those looking to comply with AML Regulations. As such, RegTech providers must be flexible and able to customise the software on a case-by-case basis depending on the operational needs of the customer. As such, Reporting Entities are advised to negotiate the inclusion of a testing phase in their agreement, during which the RegTech supplier must adapt the RegTech features to the customers’ needs.

• Cost: Reporting Entities are different in size and operation. The costs associated with the adoption of a RegTech software must be reasonable and proportionate to the AML risks. For example, the RegTech budget of a medium sized law firm should be considerably lower than that of a leading financial institution.

• Regular Software Updates: Considering the fast and continuous changes in the AML regulatory landscape, the selected RegTech service provider must be able to update its software on a regular basis to ensure that the features offered are in line with the evolving requirements.

Conclusion

Reporting Entities are strongly advised to keep a watchful eye on their AML systems and turn to RegTech to remedy the lack of human resources impediment, reduce time and costs of compliance by automating routinely tasks.

In our opinion, RegTech has a promising and broad future in the region, more specifically in the UAE. In fact, UAE regulators have become leaders in integrating cutting-edge technology to promote efficiency. Their appetite to embrace technology is backed by considerable fundings and the government’s mission to keep up with technological developments.

In light of the welcoming and favourable environment to RegTech in the UAE, more and more investors are injecting capital in RegTech start-ups which have now reached funding records worldwide.

While there is no doubt around the benefits of RegTech in the AML world, one should keep in mind that RegTech relies, among others, on Artificial Intelligence (AI) and that AI’s success depends on the data entry provided.

This means that, to improve the likelihood for successful results, Reporting Entities must record their data on the RegTech software. Such data entry must be as accurate and precise as possible. Otherwise, the results provided by the RegTech software may be misleading and incorrect. Consequently, the employment of qualified human resources remains essential to operate the RegTech software and optimise its performance.

As a final thought, we note that there are no specific licences or regulations in the UAE overseeing the establishment and operations of RegTech providers which currently hold a general technology licence. Given the stakes at hand, we anticipate regulators to interfere and impose certain conditions on RegTech entities.

Rima Mrad
Rima is a Partner with the Corporate and M&A practice, based in the DIFC offices in Dubai. She is an experienced corporate and insurance lawyer who has practiced in the UAE for over sixteen years. Rima specialises in advising insurance companies, corporate organisations, financial institutions, energy companies and private equity funds on a wide range of legal issues. These include M&A transactions, due diligence, commercial agreements, commercial related disputes, IT related transactions and various regulatory matters. She has also advised and assisted international clients in developing their business throughout the GCC, particularly in relation to regulatory and compliance matters. She also provides employment advice to companies in relation to policies, structuring and breach of contract.

Hala Harb
Hala is an associate in the TMT department with both private practice and in house experience. Hala's expertise lies in advising technology and media companies, both in commercial and regulatory matters including data privacy and fintech regulations.